audit.log, sync.log, and mailbox,log have the username and usually the client type, but not the connecting IP address. One could correlate audit.log with the rather voluminous Jetty access_log, but that's a lot of work, and it might be spoofable.